csmith

Yes! Another well-known program reducer is C-Reduce [0]. When Csmith [1] started churning out very large programs that exhibited errors in C compilers, the compiler maintainers asked the researchers to please reduce the ~81KB files to a more manageable size so they could understand the errors better. C-Reduce was developed specifically to address that need. [0] https://github.com/csmith-project/creduce [1] https://github.com/csmith-project/csmith

No. The discussion is about compiler bugs. The attack “your” solution does not apply against is if the compiler actually has a bug. Compiler have bugs, and some of these bugs cause them to silently emit the wrong assembly code for the source program passed to them. One of the authors of the original article that inspired bcrypt's blog post reported hundreds of bugs in Clang and GCC, of which about half are “wrong code” bugs: https://github.com/csmith-project/csmith/blob/master/BUGS_RE... You are right that Debian and other distributions assume that compilers do not have “wrong code” bugs, though. The only problem is that this is not true.